A security researcher known as Nightmare-Eclipse (Chaotic Eclipse) has publicly released BlueHammer, a proof-of-concept exploit that achieves local privilege escalation on Windows by abusing Microsoft Defender's internal RPC signature update interface (IMpService) and ServerMpUpdateEngineSignature calls. The sophisticated chain leverages NTFS symlinks and junctions via undocumented NT APIs, in-memory CAB extraction, Cloud Files API race conditions, and Microsoft's offline registry library to redirect Defender's SYSTEM-level operations.

Accompanied by a PGP-signed critical message to Microsoft, the researcher refused to provide full details, stating "I'm not explaining how this works, y'all geniuses can figure it out," and noted the vulnerability remains unpatched at the time of release. The PoC, hosted on GitHub with credits to contributors including Tom Gallagher, Igor Tsyganskiy, and Jeremy Tinder, contains acknowledged bugs that may affect reliability. Security experts warn this could enable attackers to escalate from regular user to SYSTEM privileges with minimal detection.